When SuiteCRM Hosted fits and when self-hosting fits
SuiteCRM Hosted fits teams that want a vendor to carry patching, backups and upgrades, and self-hosting fits teams that must keep the instance inside their own infrastructure or already run PHP and MySQL or MariaDB well. The deciding question is who carries operating work and where the data must sit. Hosted packages are priced per package with no per-user licence fees, so headcount alone does not change the monthly price, though SuiteCRM Ltd recommends up to 10 users on Starter, up to 50 on Business and up to 150 on Premium. Treat those ceilings as a sizing guide tied to package performance, not a hard limit, and test your own workload before you commit.
Data residency is the first hard condition. Starter, Business and Premium are hosted in the UK, so a regulator or customer contract that requires another jurisdiction points you to Dedicated, which offers a choice of UK, Europe or US hosting, or to self-hosting in a region you control. Confirm the residency wording in your contracts and ask SuiteCRM Ltd which regions and backup locations apply to the Dedicated package you are quoted. Check the 99.9% uptime SLA on the shared packages against your own availability requirement, since a self-hosted instance carries no vendor SLA unless you buy one separately.
Customization load and internal skills decide the rest. Heavy custom modules, bespoke integrations or changes under the public/legacy folder raise the cost of a managed platform because the vendor must agree to support them, and an existing PHP and database team can make self-hosting cheaper to operate over time. Ask for a written list of customizations and an inventory of who on your team can patch PHP, MySQL or MariaDB and restore backups. If that list is long and the skills are thin, a Hosted package or a paid migration check is usually the lower-risk start.
How the two models compare on cost, control and support
This table sets SuiteCRM Hosted's published package terms against the cost components of running SuiteCRM yourself. Read each row as a question to answer for your own team: the hosted figures are list terms, while self-hosting shifts cost into infrastructure and staff time that you control.
| Factor | SuiteCRM Hosted | Self-hosted SuiteCRM |
|---|---|---|
| Software licence | Included in the package price, with no per-user licence fees | Free to download under AGPL-3.0, with no licence fee to SuiteCRM Ltd |
| Published price | Starter £143 per month or £130 billed annually, Business £198 or £180, Premium £308 or £280, Dedicated from £3,200 per year, excluding VAT | No SuiteCRM Ltd package price. Cost is infrastructure, staff time and any paid services you buy |
| User guidance | Up to 10 users on Starter, up to 50 on Business, up to 150 on Premium; the only limit is package performance | Set by your hardware, database sizing and tuning, not by a vendor tier |
| Backups | Weekly on Starter, daily on Business and Premium | Designed, run and tested by your team or your provider |
| Upgrades and patches | Point version upgrades of the core and critical security patches included at no additional charge | Your team plans and applies every upgrade, including the SuiteCRM 7 to 8 migration |
| Hosting region | UK for Starter, Business and Premium; UK, Europe or US for Dedicated | Wherever you choose, including your own data centre or air-gapped network |
| Uptime commitment | 99.9% uptime SLA for Starter, Business and Premium; confirm the Dedicated position with SuiteCRM Ltd | No vendor SLA; availability depends on your own operating model |
| Support tier | Silver Support included on shared packages; SuiteASSURED recommended for Dedicated at additional cost | Community resources, or paid support you contract separately (confirm terms with the vendor) |
| Trial and migration | 30-day free trial; free migration of a self-hosted instance that passes a health check | Migration to the hosted service is free only after the health check; a code audit starts at £1,260 if needed |
What control and data location change for compliance
Moving from self-hosted SuiteCRM to SuiteCRM Hosted changes where data sits, who holds administrator access and who runs change control. Each of these shifts the evidence you must gather for an assessment, so confirm them before you decide.
Data location by deployment
Starter, Business and Premium packages are hosted in the UK, while Dedicated lets you choose UK, Europe or US hosting. A self-hosted instance stays wherever you put it, whether that is your cloud account, a data center or an air-gapped network. Confirm the exact regions, backup locations and any sector rules on data residency with SuiteCRM Ltd and your assessor before signing.
Administrator access and privileged accounts
On SuiteCRM Hosted, the vendor operates the platform, so your administrators do not hold server or database access by default. Self-hosting keeps root, database and application admin rights inside your own identity and privileged access processes. Ask the vendor who holds infrastructure access, how that access is logged and whether your staff can request an access review.
Change control and release timing
Hosted backups run weekly on Starter and daily on Business and Premium, and point version upgrades and critical security patches are included. In a self-hosted setup, your change board approves each patch and upgrade on your schedule. Record who approves changes in each model and whether the vendor's maintenance windows fit your change calendar.
Subprocessors and contract terms
A hosted provider brings its own infrastructure partners, which may themselves be subprocessors of your personal data. Self-hosting limits the subprocessors to the cloud, data center or support firms you choose. Request the current subprocessor list, data processing terms, breach notification commitments and the service level terms in writing, and confirm them with your legal team and assessor.
Evidence you must produce
Assessors usually want configuration baselines, access reviews, backup and restore test records, patch history and change tickets. With SuiteCRM Hosted, part of this evidence sits with the vendor and must be requested. With self-hosting, you generate and retain it yourself. DeployOpen can prepare controls and evidence for an assessment, but it does not issue audit reports or certifications, and independent auditors do.
Sector hosting and assessor sign-off
Banks, healthcare providers and public bodies often have sector-specific rules on where data is stored and who may administer it. Neither option removes that obligation, so the choice must be checked against your own rules. Take the hosting region, the administrator model and the evidence list to your assessor before you decide, and treat any gap as a reason to ask the vendor for written commitments.
What SuiteCRM Hosted runs for you each week
In the shared packages, SuiteCRM Ltd takes on the routine operating work that a self-hosted team would otherwise schedule itself. Backups run weekly on Starter and daily on Business and Premium, and point version upgrades of the core application and critical security patches are included at no additional charge. Silver Support is also included in the shared packages. For a team without a dedicated platform or DBA function, the practical question is not whether these tasks get done but how quickly a restore can be requested, what the restore point objective is in practice, and who decides when a patch is applied to a live instance with custom code.
Dedicated changes the division of labor. The vendor recommends SuiteASSURED for Dedicated, and that package carries additional cost, so the budget line should be modeled separately from the package price. Dedicated also offers a choice of UK, Europe or US hosting, which matters for data residency decisions that were settled in the self-hosted design. Ask the vendor to state in writing which backup frequency, retention period and restore process apply to Dedicated, rather than assuming the shared-package schedule carries over.
Customizations are the boundary most likely to cause friction. Upgrades and patches are provided for the core application, so any custom modules, workflows or changed custom files need a written statement of what the vendor will test, what it will leave to your team, and whether it will review changes before go-live. Confirm this scope before go-live, and if your instance carries significant customization, ask whether the free health check described for self-hosted migration is the right first step to surface the risk.
What your team runs in each model
Starter, Business and Premium are multi-tenant packages that SuiteCRM Ltd hosts in the UK. The vendor runs the application, the database and the hosting footprint, so your team administers the CRM rather than the servers beneath it. Hosting capacity is set by the package, not by a per-user fee, so the number of users you plan for matters as much as the package you pick.
- Hosting location: Starter, Business and Premium are hosted in the UK with a 99.9% uptime SLA.
- Recommended size: SuiteCRM Ltd recommends up to 10 users on Starter, up to 50 on Business and up to 150 on Premium, and states that the only user limit is package performance.
- Backups: Backups run weekly on Starter and daily on Business and Premium.
- Upgrades: Point version upgrades of the core application and critical security patches are included at no additional charge.
- Support: Silver Support is included in the shared packages.
Confirm with the vendor how the package behaves at your peak concurrent load, and whether your data residency rules accept UK hosting.
Dedicated is a single-tenant package that begins at £3,200 per year, excluding VAT. It gives you a choice of UK, Europe or US hosting, which matters when a regulator or customer contract names a region. The package still runs on infrastructure the vendor manages, so the operating split is closer to the hosted model than to self-hosting, but the hosting location and isolation are yours to choose.
- Region choice: Dedicated offers UK, Europe or US hosting.
- Isolation: The instance is not shared with other tenants, which changes the performance and change-window conversation.
- Support tier: SuiteASSURED is recommended for Dedicated at additional cost, so budget for it separately from the package.
- Upgrade and backup terms: Confirm in writing the backup frequency, restore testing and upgrade windows for Dedicated, since the shared-package terms do not carry over automatically.
- Customizations: Ask how custom modules and integrations are reviewed before each upgrade.
Ask for a written scope that lists the hosting region, the backup schedule and the support tier before you compare the Dedicated price with your own infrastructure costs.
When your team runs SuiteCRM yourself, you own the full stack. The application is PHP, so you must provide a supported PHP version, a MySQL or MariaDB database and Apache 2.4. For SuiteCRM 8.10.x, the compatibility matrix lists PHP 8.2, 8.3 and 8.4, MySQL 8.0 and 8.4, and MariaDB 10.6, 10.11, 11.4 and 11.8, on Linux, Unix or macOS. The vendor does not patch your server, so every component version becomes a standing task.
- Patch cadence: Minor 8.x releases arrive roughly every eight weeks, and patch releases contain only security and bug fixes with no database changes.
- Backup design: Back up both the database and the files, and keep the backups in a location your restore tests can reach.
- Monitoring: Watch web server, PHP and database health, plus scheduled jobs and mail delivery, since failures in these areas stop the CRM quietly.
- Upgrade testing: Run each upgrade on a staging copy first, and review customizations because the migration docs warn that non-core files under the public/legacy folder may be removed.
- Hosting footprint: Confirm the footprint for your user count with the vendor and with your own load tests, since the vendor's recommended user counts are for hosted packages.
Before you commit, check that your team has the PHP, database and Apache skills to handle these tasks on a fixed schedule.
The cost of each model is spread across different payees. In shared packages, the monthly or annual fee covers hosting, backups and core upgrades. In Dedicated, the annual fee is joined by separate support costs. In self-hosting, the software is free, but you pay your own staff, infrastructure, backup storage, monitoring tools and any outside services you buy, such as SuiteASSURED support, training or implementation from SuiteCRM Ltd or another firm.
- Recurring costs: Hosting fees, support tiers, infrastructure and staff time recur every year.
- One-time costs: Initial setup, data migration and any code audit recur only when the scope changes.
- Migration cost: A self-hosted instance can move to SuiteCRM Hosted at no cost if it passes a free health check. A code audit, needed only when customizations affect security or migration risk, starts at £1,260.
- Cost drivers: User count, customization depth, number of integrations and the region you need all push costs up.
- Quote requests: Ask for a written scope listing hosting, backups, upgrades, support tier, migration help and any audit.
Compare the total annual figure for each model over the same user count and scope, not the headline package price alone.
How to move a self-hosted instance to SuiteCRM Hosted
The sequence takes a self-hosted SuiteCRM instance through a free health check, a staged and tested copy, and a move into SuiteCRM Hosted, ending with a verified production cutover and a documented exit path.
Request the free health check
Contact SuiteCRM Ltd to start the health check on your current instance. The vendor reviews the instance, and the result tells you whether the instance passes and qualifies for the no-cost move. You own this step because the request and any access you grant come from your side. It is done when you have a written pass or a written list of findings from the vendor. Confirm with the vendor what access they need and whether the check covers your customizations before you share anything.
Decide whether a code audit is needed
A code audit is required only when customizations affect security or migration risk, and the vendor's documented starting price for it is £1,260. Review your custom modules, logic hooks, and any changes to files outside the standard core with the health check findings in hand. If the vendor flags them, ask for the audit scope and quote in writing before you approve it. This is a paid, one-time item, and its cost rises with the number and complexity of custom changes. It is done when you have a signed-off decision and, if needed, an agreed audit scope.
Back up files and database
Take a full backup of the database and the application files before any copy or migration work begins. Your team performs this step on the current server, using your own backup tooling and retention policy. The SuiteCRM migration guidance treats this as a precondition, and it protects you if the move has to be reversed. It is done when you have a restore test that confirms the backup opens and that the record counts match the live system. Keep the backup in a location the migration does not touch.
Test the migration on a staging instance
Restore the backup to a staging copy of your current SuiteCRM environment and run the migration path there first. Check logins, users, roles, scheduled jobs, email settings, and every custom module against a list of business workflows your sales and service teams use daily. Staging is your responsibility, and results are only useful if the people who use the CRM sign off on them. It is done when the test cases pass and any gaps are logged with an owner and a fix. Use the staging results to decide whether the production cutover goes ahead.
Review customizations and non-core files
Inventory every customization, including files under the public/legacy folder, because the SuiteCRM migration documentation warns that the migration may remove non-core files there. Mark each item as standard, reconfigured, or needs rework, and confirm with the vendor which items move and which must be recreated. Your development or admin team owns this inventory. It is done when every custom item has a recorded disposition and the vendor has confirmed in writing how those items will be handled.
Migrate database, settings and customizations
Once the health check, any required audit, backups, staging tests, and the customization review are complete, SuiteCRM Ltd moves the database, settings, and customizations into SuiteCRM Hosted. The vendor performs the copy, and your team confirms the data and configuration against the staging results. The fee for a passing instance is documented as no cost, but confirm that in your written order. It is done when the hosted instance matches the source for the agreed test cases and your users can log in.
Cut over users and confirm sign-in
Schedule the switch with your users, redirect them to the hosted address, and check identity settings. If you use LDAP or SAML, confirm that sign-in works with the vendor's configuration. Note that the SuiteCRM 8.7.0+ SAML implementation does not end the SuiteCRM session when a user logs out at the identity provider, so brief your users on that. It is done when a test set of users has completed sign-in and core tasks, and the old instance is set to read-only for a period you agree with the vendor.
Plan the exit and ask about data export
Before you close the migration, ask the vendor in writing how you can export your full database, files, and settings, and in what format. Ask whether a reverse move to a self-hosted instance is supported, what it costs, and how long the vendor needs for it. The Hosted page's terms and any SLA details are the documents to read here, so confirm them with the vendor rather than assuming. It is done when you hold a tested export, a written answer on the reverse move, and a retained copy of the last backup.
How customizations and SSO affect the choice
Custom code, non-core files and the sign-in method often matter more than the monthly package price. A self-hosted SuiteCRM instance carries your own modules, templates and public/legacy changes, and you decide how they are tested and upgraded. Under SuiteCRM Hosted, the provider runs the core application and critical security patches, but any customization you bring in still has to be reviewed for fit with the hosted environment. Before committing, ask SuiteCRM Ltd which customizations they accept, how they are reviewed, and whether a free health check would flag them. The free migration into Hosted assumes a health check passes, and the code audit referenced for customizations that affect security or migration risk starts at £1,260, so a heavily modified instance may carry a cost that a plain one does not.
Sign-in is the second decision point. SuiteCRM 8 supports LDAP through AUTH_TYPE=ldap and SAML through AUTH_TYPE=saml, and the SAML path has a limitation you must plan for. From SuiteCRM 8.7.0 onward, the SAML implementation does not support IdP-initiated logout or POST binding to the logout service, so signing out at your identity provider does not end the SuiteCRM session. Users who share workstations or rely on central sign-out for offboarding need a compensating control, such as short session lifetimes or a documented offboarding step. Whether a hosted package can accept your identity provider settings, and whether it exposes the auth configuration you need, is not something this page can confirm, so ask the vendor directly and get the answer in writing.
Treat the sign-in check as a gating item in your evaluation. Write down your chosen method (LDAP, SAML or none), the identity provider you use, and the logout behavior your access policy requires. Then ask SuiteCRM Ltd to confirm in writing that the Starter, Business, Premium or Dedicated package supports that method with the same settings you would use on your own servers. If the answer is partial, a self-hosted deployment gives you control over the auth configuration, at the cost of owning the SAML and LDAP maintenance yourself.
Questions buyers ask before choosing a hosting model
What drives the cost of SuiteCRM Hosted compared with running SuiteCRM yourself?
The hosted price is a package fee, so the main cost driver is which package fits your user count and workload. SuiteCRM Ltd lists Starter at £143 per month billed monthly or £130 billed annually, Business at £198 or £180, and Premium at £308 or £280, all excluding VAT and with no per-user licence fees. Dedicated starts from £3,200 per year. Self-hosting has no licence fee, but you pay for servers, staff time to patch and back up, and any outside help you buy. Ask the vendor which package your user count and workload require, whether VAT is added, and what happens to the price if you outgrow the package.
Does the SuiteCRM Hosted price cover customizations?
The published package price covers hosting, backups and included upgrades, but the hosted facts do not state that custom modules or integrations are covered by the package fee. Customizations affect how easily point upgrades and security patches apply, so review them before you commit. A code audit is needed only when customizations affect security or migration risk, and SuiteCRM Ltd states it starts at £1,260. Ask in writing whether custom development, third-party integration work and custom code review are included, and what they cost separately.
How long does a migration to SuiteCRM Hosted take, and what does it need from my team?
No duration is published for migrations, so ask for a timeline in writing. The migration moves the database, settings and customizations of a self-hosted instance, and SuiteCRM Ltd offers this at no cost if the instance passes its free health check. Your team should prepare a current backup, a list of customizations and the users and integrations that depend on them, and a person who can confirm test results. Ask what the health check covers, what happens if it fails, and whether a code audit would be needed for your customizations.
Can we run self-hosted SuiteCRM without outside help?
Yes, if your team already runs PHP applications on MySQL or MariaDB and can keep servers patched. The SuiteCRM 8.10.x compatibility matrix lists PHP 8.2, 8.3 and 8.4, MariaDB 10.6, 10.11, 11.4 and 11.8, MySQL 8.0 and 8.4, and Apache 2.4 as supported, and you must maintain that stack yourself. Point version upgrades and security patches are included in the hosted packages, so in a self-hosted model your team carries that work. Consider whether you need a support package such as SuiteASSURED, which the vendor recommends for Dedicated at additional cost, and confirm its scope before budgeting.
What changes if we move from SuiteCRM 7 to SuiteCRM 8?
The move is a migration, not an upgrade. SuiteCRM documents it as a new SuiteCRM 8 environment with the SuiteCRM 7 data moved into it, and the 7 instance must first be brought to 7.14.x or later. The migration docs advise testing on staging, backing up files and database, and reviewing customizations, because the process may remove non-core files under the public/legacy folder. Hosted packages do not change that work. SuiteCRM 7.15 has security fixes until January 2028, so you can plan the move on your own timeline. Ask the vendor whether it will carry out the migration and what it charges for it.
Which hosting location and uptime terms should I confirm before signing?
Starter, Business and Premium are hosted in the UK with a published 99.9% uptime SLA, while Dedicated offers a choice of UK, Europe or US hosting. If data residency matters for your regulator or contracts, the shared packages keep you in the UK and Dedicated lets you pick a region. Ask for the written SLA, the service credits it carries, the backup retention period and where backups are stored. Also ask how a backup restore is tested, because weekly backups on Starter and daily backups on Business and Premium are a different recovery position.
What user limits and performance limits apply to each package?
SuiteCRM Ltd recommends up to 10 users on Starter, up to 50 on Business and up to 150 on Premium, and states that the only user limit is the performance of the package. That means the practical limit depends on your workload, such as reports, integrations and data volume, not a hard seat cap. Test your heaviest workflow on the trial before you commit. The hosted service includes a 30-day free trial, which you should use with a realistic data set. Ask what performance measurements the vendor uses to decide when a package is too small.
How DeployOpen scopes and runs self-hosted SuiteCRM
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades and documents self-hosted open-source platforms inside the client's own infrastructure. For SuiteCRM, that means the choice between a hosted package and a self-run instance is made on your hosting footprint, identity rules and customization needs, with the work agreed in writing before anything changes.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope lists user counts, hosting location, database choice and any SAML or LDAP sign-in requirements.
- Customizations are inventoried up front so we can flag which ones affect security or migration risk.
How we build
- Installation runs in your cloud accounts, data centers or air-gapped network, on the PHP, MariaDB or MySQL versions the compatibility matrix supports.
- Identity integration is configured and tested for SAML or LDAP, including the logout behavior your identity provider will actually see.
- Backup, upgrade and staging procedures are documented and tested before any production change is made.
How we hand over
- You receive architecture, configuration and runbook documentation covering the deployed SuiteCRM instance.
- Staging-tested migration plans are delivered where a move from an existing instance, or from SuiteCRM 7 to 8, is in scope.
- Knowledge transfer sessions cover administration, backup restores and the upgrade steps your team will run.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after go-live.
- Compliance evidence and control documentation are prepared for your assessors, who issue any audit report or certification.
- Confirm with us in the quote which upgrade, patch and support responsibilities sit with DeployOpen and which stay with you.
